Ansible Variables & Vault (Secrets Management)

Variables let you reuse playbooks across environments. Vault encrypts sensitive values so they are safe to commit to version control.

Learning outcomes

By the end you can:

• define and use variables at different scopes
• use host_vars and group_vars for per-host/group config
• encrypt secrets with Ansible Vault
• reference Vault-encrypted variables in playbooks

1) Variable scopes (where variables live)

2) group_vars — configure groups

Create group_vars/web.yml to apply to all hosts in the [web] group:

# group_vars/web.yml
nginx_port: 80
deploy_user: deploy
app_env: production

Create group_vars/all.yml for variables shared across every host:

# group_vars/all.yml
ntp_server: pool.ntp.org
log_retention_days: 30

3) host_vars — per-host config

Create host_vars/web1.example.com.yml:

# host_vars/web1.example.com.yml
nginx_port: 8080        # override the group default for this host
max_connections: 2048

4) Variable interpolation

In playbooks and templates, reference variables with {{ }}:

- name: Create app directory
  ansible.builtin.file:
    path: "/var/www/{{ app_name }}"
    state: directory
    owner: "{{ deploy_user }}"
    mode: "0755"

In Jinja2 templates:

server {
    listen {{ nginx_port }};
    server_name {{ inventory_hostname }};
}

5) Ansible Vault — encrypt secrets

Never store passwords or API keys as plain text. Vault encrypts them so you can safely commit to version control.

Encrypt a single variable file

ansible-vault encrypt group_vars/web/vault.yml

You’ll be prompted for a vault password. The file becomes an encrypted blob.

Create a new encrypted file from scratch

ansible-vault create group_vars/web/vault.yml

This opens your editor. Add variables as normal YAML:

vault_db_password: "SuperSecretPass123"
vault_api_key: "sk-abc123..."

Edit an encrypted file

ansible-vault edit group_vars/web/vault.yml

View without decrypting in place

ansible-vault view group_vars/web/vault.yml

6) Referencing Vault variables in playbooks

Convention: prefix vault variables with vault_, then alias them in a plain vars file.

# group_vars/web/vars.yml  (plain, committed)
db_password: "{{ vault_db_password }}"
api_key: "{{ vault_api_key }}"

# group_vars/web/vault.yml  (encrypted, also committed)
vault_db_password: "SuperSecretPass123"
vault_api_key: "sk-abc123..."

Playbook uses db_password without knowing it is vault-backed:

- name: Configure database connection
  ansible.builtin.template:
    src: db.conf.j2
    dest: /etc/app/db.conf

7) Running playbooks with Vault

Provide the vault password at runtime:

# Prompt for password
ansible-playbook -i inventory.ini site.yml --ask-vault-pass

# Use a password file (useful in CI)
ansible-playbook -i inventory.ini site.yml --vault-password-file ~/.vault_pass

In CI, store the vault password as a secret and write it to a temp file:

echo "$VAULT_PASSWORD" > /tmp/vault_pass
ansible-playbook -i inventory.ini site.yml --vault-password-file /tmp/vault_pass
rm /tmp/vault_pass

8) Practical example: full variable structure

inventory.ini
group_vars/
  all.yml           # shared variables
  web/
    vars.yml        # web group variables (plain)
    vault.yml       # web group secrets (encrypted)
host_vars/
  web1.example.com.yml  # host-specific overrides

Playbook:

---
- name: Deploy web application
  hosts: web
  become: true
  roles:
    - nginx_role
    - app_role
  vars:
    app_name: myapp
    app_version: "2.1.0"

Next steps

• Advanced playbook patterns: loops, conditionals, error handling
• Running Ansible in CI/CD pipelines
• Ansible Tower / AWX for enterprise automation